← Catalog
Research medium discovered 2016-10-28

Evading Face Recognition with Adversarial Eyeglass Frames

Printed adversarial patterns on ordinary eyeglass frames let a wearer evade or impersonate identities to a face-recognition model — a physically realizable attack that dodges or fools identification while looking unremarkable.

AI Attack Staging AI Model Access Initial Access Defense Evasion Impact

What happened

Sharif et al. (referenced by MITRE ATLAS as AML.CS0012) showed that adversarial patterns printed on eyeglass frames can defeat deep face-recognition systems in the physical world. A person wearing the specially patterned frames could either evade recognition (not be matched to their true identity) or impersonate a specific target identity, while the glasses themselves looked like ordinary eyewear.

Because the perturbation lives on a wearable object rather than in a digital image, it is a practical, real-world evasion of biometric identification — the face-recognition analogue of the adversarial road-sign attacks.

Why it maps to ATLAS

  • AML.T0043 — Craft Adversarial Data: the frame pattern is an optimized adversarial input.
  • AML.T0041 — Physical Environment Access: the perturbation is delivered via a physical object in front of the camera.
  • AML.T0015 — Evade AI Model: the model fails to correctly identify (or is fooled into misidentifying) the subject.

Detection notes

Single-frame match confidence is not enough against physical evasion. Layer in presentation-attack detection and liveness, cross-check with other signals, and require multi-factor confirmation for high-stakes identity decisions. Concentrated adversarial texture around facial landmarks — like patterned frames — is a signal worth modeling explicitly.

Detection

Log sources

  • Match-confidence + liveness telemetry
  • Presentation-attack-detection (PAD) signals

Signals

  • High-confidence matches to a different identity while wearing patterned accessories
  • Unusual textures/patterns concentrated around facial landmarks
  • Confidence inconsistent with other biometric/context signals

Mitigations

  • Presentation-attack detection and liveness checks
  • Adversarial training + multi-factor identity confirmation
  • Human review for high-stakes identity decisions